CVE-2021-3825

Published: Oct 1, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD (Secondary)

Description

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.

Affected (1)

Products: Pardus: Liderahenk

Pardus

1 product

Liderahenk

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pardus Liderahenk	Up to 2.1.15

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (5)

https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/

Source: iletisim@usom.gov.tr

ExploitThird Party Advisory

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-21-0795

Source: iletisim@usom.gov.tr

https://www.usom.gov.tr/bildirim/tr-21-0795

Source: iletisim@usom.gov.tr

Third Party Advisory

https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.usom.gov.tr/bildirim/tr-21-0795

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.